The BlackLock ransomware group has become one of the most prolific operators in the Ransomware as a Service (RaaS) ecosystem, with experts warning it could accelerate its growth over the next year.
Also known as El Dorado, BlackLock was ranked as the seventh most active ransomware group based on the number of posts on its data leak site by the end of 2024, marking a 1,425% growth from Q3.
Security firm ReliaQuest recently published research on the group and its rise to prominence, detailing its TTPs and why the operation has seen so much success in recent years.
The group was among the top three most active collectives on the RAMP forum, whose community listed BlackLock among the top ransomware operators in terms of their reputation on the site.
Reliaquest noted that BlackLock’s rise has been both “swift and strategic” and predicted that if the group’s activity continues at this pace it will go on to become the most active ransomware group in 2025.
The group is known to use double extortion tactics whereby they encrypt data while also stealing sensitive information, hoping to exert more pressure on victims with the potential threat of exposing the stolen information.
Its ransomware is custom-built to target Windows, VMWare ESXi, and Linux environments, although Reliquest noted that the Linux variant is less mature than its Windows counterpart.
Why BlackLock stands out from the crowd
The report identifies a number of ways in which BlackLock has set itself apart in what is a highly competitive digital extortion landscape, firstly with what it describes as an unusual leak site that uses a combination of unique tricks aimed at preventing researchers from downloading stolen data.
The site is “packed” with a number of features that Reliaquest speculates are intended to prevent targeted organizations from assessing the scope of their breaches.
“This, in turn, ramps up pressure on the organizations to quickly pay ransoms, often before they can fully evaluate the situation,” researchers said.
“These features also highlight BlackLock’s technical sophistication, reinforcing its reputation as a polished, professional operation.”
RELATED WHITEPAPER
BlackLock’s use of custom-built malware is another indicator of their sophistication, Reliaquest added, which it said is a hallmark of top-tier groups such as Qlin or Play.
Competing groups like Bl00dy, Dragonforce, and RA World rely on externally developed ransomware builders such as leaked versions of Babuk or LockBit, the report notes, whereas BlackLock develops its own bespoke malware.
“While leaked ransomware builders are easy to use, they come with a major drawback: Security researchers can access and dissect the code, find weaknesses, and develop defenses against them. In contrast, BlackLock’s custom malware keeps researchers in the dark — at least until its source code is leaked.”
Reliaquest also reported the group has been actively recruiting affiliates known as ‘traffers’ to support the earlier stages of their attacks, whereas it has been far more discreet when looking to bring higher-level developers on board.
BlackLock targets need to be wary
The report identified potential indicators for BlackLock’s next major targets, citing forum activity that would suggest the group plans on exploiting Microsoft Entra Connect in an upcoming campaign.
A user known to represent BlackLock was found sharing security research on how attackers could abuse Entra Connect’s synchronization mechanism to manipulate user attributes and compromise on-prem environments.
“For organizations managing multiple domains under one tenant, this tactic creates a significant risk of privilege escalation and the potential for a major breach. While the blog describes the attack hypothetically, its feasibility and potential impact make it a serious concern.,” Reliaquest warned.
As a result, organizations should reassess the security of their infrastructure now, Reliaquest urged, stating that in particular, they should look to harden their rules around sensitive attributes, monitor and restrict key registrations, and enforce conditional access policies.
MORE FROM ITPRO
- Life after LockBit: A fragmented landscape and wayward affiliates will still cause chaos for enterprises
- 8Base ransomware members snared in global police crackdown
- Cisco dispels Kraken data breach claims, insists stolen data came from old attack
-
Using DeepSeek at work is like ‘printing out and handing over your confidential information’News Thinking of using DeepSeek at work? Think again. Cybersecurity experts have warned you're putting your enterprise at huge risk.
-
Can cyber group takedowns last?ITPro Podcast Threat groups can recover from website takeovers or rebrand for new activity – but each successful sting provides researchers with valuable data
-
Warning issued as new Pakistan-based malware group hits millions globallyNews Tempting people in with offers of pirated software, the network installs commodity infostealers, according to CloudSEK
-
Average ransom payment doubles in a single quarterNews Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new groupNews The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos
-
Google cyber researchers were tracking the ShinyHunters group’s Salesforce attacks – then realized they’d also fallen victimNews In an update to an investigation on the ShinyHunters group, Google revealed it had also been affected
-
Nearly one-third of ransomware victims are hit multiple times, even after paying hackersNews Many ransomware victims are being hit more than once, largely thanks to fragmented security tactics
-
75% of UK business leaders are willing to risk criminal penalties to pay ransomsNews A ransom payment ban is a great idea - until you're the one being targeted...
-
The Scattered Spider ransomware group is infiltrating Slack and Microsoft Teams to target vulnerable employeesNews The group is using new ransomware variants and new social engineering techniques - including sneaking into corporate teleconferences
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crimeNews A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
